feat(gateway): add update commands

[aidandaly24]

Summary

• add Gateway, Target, and Rule update commands with explicit set and clear semantics
• merge replacement-style Gateway and Target updates from current service state
• add new CLI-owned Target role permissions before update
• remove obsolete Target permissions only after a successful update
• leave the additive policy in place when update outcome is uncertain
• bypass IAM reconciliation for customer-managed Gateway roles

Stack

• base: feat(gateway): add create commands #1899
• this PR: feat(gateway): add update commands #1900
• next: feat(gateway): add delete commands #1901

Testing

• bun test src/core/gateway.update.test.ts src/core/gatewayExecutionRole.test.ts src/handlers/gateway/gateway.update.test.tsx src/handlers/gateway/gateway.test.tsx (55 pass)
• source-scoped TypeScript, lint, and formatting checks
• live AWS test with AWS_PROFILE=deploy: updated one Target from Lambda A to Lambda B and confirmed the role policy retained B and removed A